Core System Review

We converted to a new Core (KeyStone by Corelation) about 9 months ago.  Internal Audit performed a post-implementation review of roles and privileges, and we have identified that some roles have privileges that may be unnecessary or present segregation of duties issues.  I'd like to know how other CU's review their core systems, especially after you've let a new implementation settle.  Who facilitates the review, how detailed is the review, is there final sign-off, etc?  Thank you!